Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path and at the bare root of the published port (:9583), so Home Assistant ingress can serve the "Open Web UI" button. The root-mounted routes perform no authentication — no secret, no Origin check, no CSRF token — so any client that can reach :9583 without the MCP secret can invoke them. Affected configurations Home Assistant add-on installations (hostnetwork: true with port 9583 published), v7.6.0 and earlier. Docker and standalone installs are not affected — there the settings routes are mounted only under the secret path. Root-mounted routes in affected versions: tool visibility (/api/settings/tools GET/POST), feature flags (/api/settings/features GET/POST), the auto-backup suite (/api/settings/backups… incl. restore/delete, and /api/settings/backup-config), add-on restart (/api/settings/restart), and — when the opt-in Tool Security Policies feature is enabled — the approval-policy API…
Recommended action: Upgrade to 7.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When ENABLEYAMLCONFIGEDITING=true, every haconfigsetyaml call backs up the pre-edit file to <config/www/yamlbackups/, which Home Assistant serves at /local/ with no authentication. Anyone who can reach the HA web interface can download the most recent pre-edit configuration.yaml (or other YAML file) — typically containing plaintext MQTT passwords, REST credentials, webhook IDs, geofence coordinates, and shellcommand definitions — with zero credentials. Details The backup feature is good — dobackup defaults to True and protects users from a bad edit. The issue is the location: - customcomponents/hamcptools/init.py:596 — backupdir = configdir / "www" / "yamlbackups" - customcomponents/hamcptools/init.py:602 — backupfile = backupdir / f"{safename}.{timestamp}.bak" - customcomponents/hamcptools/init.py:606-607,692-693 — backup path returned to caller and logged at INFO <config/www/ is /local/ and HA serves it unauthenticated by design (intended for static dashboard assets). An…
Recommended action: Upgrade to 7.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The ha-mcp OAuth consent form renders user-controlled parameters via Python f-strings with no HTML escaping. An attacker who can reach the OAuth endpoint and convince the server operator to follow a crafted authorization URL could execute JavaScript in the operator's browser. This affects only users running the beta OAuth mode (ha-mcp-oauth), which is not part of the standard setup and requires explicit configuration. Details Unescaped f-string rendering consentform.py builds HTML using Python f-strings. No call to html.escape() exists anywhere in the file. The following values are rendered unescaped: - clientname / clientid — in HTML element context (lines 299, 303) - clientid, redirecturi, state — in HTML attribute context (lines 310–312), where a " character breaks out of value="" - errormessage, error, errordescription — in error display paths (lines 36–40, 496–497) An attacker can register a client with a malicious clientname via the /register (DCR) endpoint, which…
Recommended action: Upgrade to 7.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The ha-mcp OAuth consent form (beta feature) accepts a user-supplied haurl and makes a server-side HTTP request to {haurl}/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional code paths in OAuth tool calls (REST and WebSocket) are affected by the same primitive. The primary deployment method (private URL with pre-configured HOMEASSISTANTTOKEN) is not affected. Details Code path 1 — Consent form validation (reported) When a user submits the OAuth consent form, validatehacredentials() (provider.py) makes a server-side GET request to {haurl}/api/config with no scheme, IP, or domain validation. Different exception types produce distinct error messages, creating an error oracle: | Outcome | Message returned | Information leaked | |---------|------------------|--------------------| | ConnectError | "Could not connect..." | Host down or port closed | | TimeoutException…
Recommended action: Upgrade to 7.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.